Overview
  1. 03.01: Access Control
  2. 03.02: Awareness and Training
  3. 03.03: Audit and Accountability
  4. 03.04: Configuration Management
  5. 03.05: Identification and Authentication
  6. 03.06: Incident Response
  7. 03.07: Maintenance
  8. 03.08: Media Protection
  9. 03.09: Personnel Security
  10. 03.10: Physical Protection
  11. 03.11: Risk Assessment
  12. 03.12: Security Assessment
  13. 03.13: System and Communications Protection
  14. 03.14: System and Information Integrity

Security Requirements for 03.14.07 Identify Unauthorized Use

System monitoring includes external and internal monitoring. System monitoring can detect unauthorized use of organizational systems. System monitoring is an integral part of continuous monitoring and incident response programs. Monitoring is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Output from system monitoring serves as input to continuous monitoring and incident response programs.Unusual/unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements.[SP 800-94] provides guidance on intrusion detection and prevention systems.

Assessment GuidanceExamine 0/10

How an assessor determines this requirement is met. Source: CMMC Assessment Guide – Level 2, Version 2.13 (NIST SP 800-171 Rev. 2).

Discussion

Define authorized use of your systems. Create an acceptable use policy to establish the baseline for how users access devices, internal network services, and the internet. Define authorized use by specific roles such as: user, administrator, and technician. After authorized use is defined, identify unauthorized use of systems. Monitor systems by observing audit activities from the system logs. This can be accomplished in real time using automated solutions or by manual means. To identify unauthorized use, leverage existing tools and techniques, such as:

intrusion detection systems;

intrusion prevention systems;

malicious code protection software; scanning tools;

audit record monitoring software; and network monitoring software.

This requirement, SI.L2-3.14.7, which deals with identifying unauthorized use of organizational systems, is related to requirements: AC.L2-3.1.1, AU.L2-3.3.1, IA.L2-3.5.1, and IA.L2-3.5.2. All of these requirements help create the building blocks that support SI.L2-3.14.7.

Examples

  1. Example 1

    You are in charge of IT operations. You need to ensure that everyone using an organizational system is authorized to do so and conforms to the written authorized use policy. To do this, you deploy an application that monitors user activity and records the information for later analysis. You review the data from this application for signs of activity that does not conform to the acceptable use policy [a, b].

  2. Example 2

    You are alerted through your Intrusion Detection System (IDS) that one of your users is connecting to a server that is from a high-risk domain (based on your commercial domain reputation service). You investigate and determine that it’s not the user, but instead an unauthorized connection attempt [b]. You add the domain to your list of blocked domains to prevent connections in the future.

Assessment Methods

Examine
The process of reviewing, inspecting, observing, studying, or analyzing assessment objects (e.g., policies, procedures, plans, system designs, mechanisms) to facilitate understanding, achieve clarification, or obtain evidence.Example: An assessor reads the access control policy and inspects system configuration settings to confirm they match.

Not all of the evidence listed is required to meet this requirement — check the items your organization has collected.

Interview
The process of holding discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or identify the location of evidence.Example: An assessor asks a system administrator to describe how user accounts are approved, reviewed, and disabled.
  • System or network administrators
  • Personnel with information security responsibilities
  • Personnel installing, configuring, and maintaining the system
  • Personnel with responsibility for monitoring the system
Test
The process of exercising assessment objects (e.g., activities, mechanisms) under specified conditions to compare actual behavior with expected behavior.Example: An assessor attempts to sign in with a disabled account to confirm that access is denied.
  • Organizational processes for system monitoring
  • Mechanisms supporting or implementing system monitoring capability

Potential Assessment Considerations

  • Is authorized use of systems defined (e.g., data types permitted for storage or processing, personnel authorized to access, times or days of permitted use, permitted software) [a]?
  • Is unauthorized use of systems defined (e.g., not authorized to use systems for bitcoin mining, not authorized for pornographic content, not authorized to access gambling games/content) [b]?

Key References

NIST SP 800-171 Rev. 2 3.14.7Appendix A – Acronyms and AbbreviationsAppendix A – Acronyms and AbbreviationsACAccess ControlAESAdvanced Encryption StandardAPIApplication Programming InterfaceATAwareness and TrainingAUAudit and AccountabilityC3PAOCMMC Third-Party Assessment OrganizationCASecurity AssessmentCD-ROMCompact Disk Read-Only MemoryCFRCode of Federal RegulationsCMConfiguration ManagementCMMCCybersecurity Maturity Model CertificationCMVPCryptographic Module Validation ProgramCUIControlled Unclassified InformationCVECommon Vulnerabilities and ExposuresCWECommon Weakness EnumerationDCMADefense Contract Management AgencyDFARSDefense Federal Acquisition Regulation SupplementDHCDevice Health CheckDIBCACDefense Industrial Base Cybersecurity Assessment CenterDMZDemilitarized ZoneDoDDepartment of DefenseDVDDigital Versatile Disc or Digital Video DiscESPExternal Service ProviderFAQFrequently Asked QuestionFARFederal Acquisition RegulationFDDIFiber Distributed Data InterfaceFDEFull Disk EncryptionFIPSFederal Information Processing StandardFTPFile Transfer ProtocolIAIdentification and AuthenticationIDIdentificationIDSIntrusion Detection SystemAppendix A – Acronyms and AbbreviationsIoTInternet of ThingsIPInternet ProtocolIPSecInternet Protocol SecurityIRIncident ResponseISACInformation Sharing and Analysis CenterISDNIntegrated Services Digital NetworkITInformation TechnologyLANLocal Area NetworkMAMaintenanceMACMedia Access ControlMDMMobile Device ManagementMFAMultifactor AuthenticationMPMedia ProtectionNARANational Archives and Records AdministrationNASNetworked Attached StorageNISTNational Institute of Standards and TechnologyNSANational Security AgencyNTPNetwork Time ProtocolOSOperating SystemOSAOrganization Seeking AssessmentOSCOrganization Seeking CertificationOTOperational TechnologyPDAPersonal Digital AssistantPEPhysical ProtectionPIVPersonal Identity VerificationPKIPublic Key InfrastructurePOTSPlain Old Telephone ServicePSPersonnel SecurityRADIUSRemote Authentication Dial-in User ServiceRARisk AssessmentSCSystem and Communications ProtectionSISystem and Information IntegritySMSShort Message ServiceSOCSecurity Operations CenterAppendix A – Acronyms and AbbreviationsSPSpecial PublicationSSPSystem Security PlanTLSTransport Layer SecurityURLUniversal Resource Locator (aka Uniform Resource Locator)USBUniversal Serial BusUTCCoordinated Universal TimeUUENCODE Unix-to-Unix EncodeVLANVirtual Local Area NetworkVoIPVoice over Internet ProtocolVPNVirtual Private NetworkWPA2-PSKWiFi Protected Access-Pre-shared Key

Evidence

  1. 03.14.07.a

    Authorized use of the system is defined

  1. 03.14.07.b

    Unauthorized use of the system is identified